CVE-2017-8227

Amcrest IPM-721S V2.420.AC00.16.R.20160909 devices expose a credential-bruteforce risk via ONVIF: account lockout is bypassed, allowing credential guesswork and potential takeover. Root cause is a vulnerable ONVIF authentication path in the binary (sonia) that does not enforce the 5-minute timeou...

CVE-2017-8230

On Amcrest IPM-721S V2.420.AC00.16.R.20160909 devices, the users on the device are divided into 2 groups "admin" and "user". However, as a part of security analysis it was identified that a low privileged user who belongs to the "user" group and who has access to login in to the web administrativ...

CVE-2017-8230

The CVE-2017-8230 entry concerns Amcrest IPM-721S devices with firmware V2.420.AC00.16.R.20160909. A low-privilege user can authenticate to the web admin interface and add a new admin account via HTTP APIs, gaining full admin capabilities. The root cause is an authorization bypass in the HTTP API...

CVE-2017-8226

Amcrest IPM-721S V2.420.AC00.16.R.20160909 devices have default credentials that are hardcoded in the firmware and can be extracted by anyone who reverses the firmware to identify them. If the firmware version V2.420.AC00.16.R 9/9/2016 is dissected using binwalk tool, one obtains a...

CVE-2017-8229

Amcrest IPM-721S V2.420.AC00.16.R.20160909 devices allow an unauthenticated attacker to download the administrative credentials. If the firmware version V2.420.AC00.16.R 9/9/2016 is dissected using binwalk tool, one obtains a user-x.squashfs.img.extracted archive which contains the filesystem set...

CVE-2017-8229

Amcrest IPM-721S devices (V2.420.AC00.16.R.20160909) are affected by CVE-2017-8229: unauthenticated attackers can download administrative credentials via exposed configuration files (e.g., /current_config) without authentication. The root cause is a misconfigured or exposed current_config path th...

Critical Flaws in Amcrest HDSeries Camera Allow Complete Takeover

Two critical severity bugs have been publicly disclosed that impact Amcrest HDSeries model IPM-721S cameras. Both vulnerabilities open the consumer-grade $50 Wi-Fi cameras to complete takeover by remote, unauthenticated attackers. Mandar Satam, senior security researcher at Synopsys, found the si...

ipm.ucanr.edu XSS vulnerability

Vulnerable URL: http://ipm.ucanr.edu/TOOLS/PNAI/pnaishow.php?id=13'"37 Details: Description| Value ---|--- Patched:| No Latest check for patch:| 28.12.2017 Vulnerability type:| XSS Vulnerability status:| Publicly disclosed Alexa Rank| 44833 VIP website status:| Yes Coordinated Disclosure Timeline...

ipm.ucanr.edu XSS vulnerability

Vulnerable URL: http://ipm.ucanr.edu/VIDEO/player.swf?tracecall=prompt%27openbugbounty%27 Details: Description| Value ---|--- Patched:| Verification in progress Latest check for patch:| 15.11.2017 Vulnerability type:| XSS Vulnerability status:| Publicly disclosed Alexa Rank| Unknown / Not...

HP Insight Control Power Management < 6.1 Local Unauthorized Access

The version of HP Insight Control Power Management installed on the remote host is earlier than 6.1. Such versions have an unspecified local security bypass vulnerability. C Tenable Network Security, Inc. include"compat.inc"; if description scriptid47780; scriptversion"1.10"; scriptcvsdate"Date:...

Buffer overflow

Buffer overflow in Cisco CiscoWorks Internetwork Performance Monitor IPM 2.6 and earlier on Windows, as distributed in CiscoWorks LAN Management Solution LMS, allows remote attackers to execute arbitrary code via a malformed getProcessName CORBA General Inter-ORB Protocol GIOP request, related to...

CVE-2010-0138

Buffer overflow in Cisco CiscoWorks Internetwork Performance Monitor IPM 2.6 and earlier on Windows, as distributed in CiscoWorks LAN Management Solution LMS, allows remote attackers to execute arbitrary code via a malformed getProcessName CORBA General Inter-ORB Protocol GIOP request, related to...

CVE-2010-0138

Buffer overflow in Cisco CiscoWorks Internetwork Performance Monitor IPM 2.6 and earlier on Windows, as distributed in CiscoWorks LAN Management Solution LMS, allows remote attackers to execute arbitrary code via a malformed getProcessName CORBA General Inter-ORB Protocol GIOP request, related to...

CVE-2010-0138

CiscoWorks Internetwork Performance Monitor (IPM) for Windows, version 2.6 and earlier (bundled with CiscoWorks LMS), contains a buffer overflow in CORBA GIOP request handling (getProcessName). The flaw can be triggered remotely by a crafted GIOP request, enabling arbitrary code execution with SY...

Cisco Buffer Overflow, DDoS Flaws Revealed

Cisco has discovered a buffer overflow in version 2.6 of CiscoWorks Internetwork Performance Monitor IPM and previous versions for Windows; the flaw allows attackers to compromise vulnerable systems remotely, as well as a DDos flaw in Cisco IOS XR. Read the full article. The H Security...

ZDI-10-004: Cisco CiscoWorks IPM GIOP getProcessName Remote Code Execution Vulnerability

ZDI-10-004: Cisco CiscoWorks IPM GIOP getProcessName Remote Code Execution Vulnerability http://www.zerodayinitiative.com/advisories/ZDI-10-004 January 21, 2010 -- CVE ID: CVE-2010-0138 -- Affected Vendors: Cisco -- Affected Products: Cisco Internetwork Performance Monitor -- TippingPointTM IPS...

Cisco CiscoWorks IPM GIOP getProcessName Remote Code Execution Vulnerability

This vulnerability allows remote attackers to execute arbitrary code on vulnerable installations of Cisco CiscoWorks Internetwork Performance Monitor. Authentication is not required to exploit this vulnerability. The specific flaw exists in the handling of CORBA GIOP requests. By making a special...

Cisco Security Advisory: CiscoWorks Internetwork Performance Monitor CORBA GIOP Overflow Vulnerability

-----BEGIN PGP SIGNED MESSAGE----- Hash: SHA1 Cisco Security Advisory: CiscoWorks Internetwork Performance Monitor CORBA GIOP Overflow Vulnerability Advisory ID: cisco-sa-20100120-ipm Revision 1.0 For Public Release 2010 January 20 1600 UTC GMT...

Cisco CiscoWorks Internetwork Performance Monitor Remote Command Execution

Binary data ciscoworksipm.nbin...

CiscoWorks Internetwork Performance Monitor远程命令执行漏洞

BUGTRAQ ID: 28249 CVECAN ID: CVE-2008-1157 CiscoWorks IPM是可测量网络响应时间和可用性的故障检测应用。 Solaris和Windows平台上的的IPM 2.6版中的一个进程可导致将命令shell自动绑定到随机选择的TCP端口上，未经认证的远程用户可以连接到开放的端口上并在Solaris系统上以casuser权限或在Windows系统上以SYSTEM权限执行任意命令。 Cisco Internetwork Performance Monitor 2.6 厂商补丁： Cisco -----...